Merge branch 'master' into telnet_port

docs/ftldns/configfile.md

@@ -1,5 +1,7 @@
 You can create a file `/etc/pihole/pihole-FTL.conf` that will be read by *FTL*DNS on startup.
 
+Note: comments need to start with `#;` to avoid issues with PHP and `bash` reading this file. (See [https://github.com/pi-hole/pi-hole/pull/4081](https://github.com/pi-hole/pi-hole/pull/4081)  for more details)
+
 Possible settings (**the option shown first is the default**):
 
 ---

docs/ftldns/dnsmasq_warn.md

@@ -130,10 +130,10 @@ Warnings commonly seen in `dnsmasq`'s log file (`/var/log/pihole.log`) and the P
     You can get rid of the warning by adding a config file like `/etc/dnsmasq.d/99-edns.conf` and adding
 
     ``` plain
-    edns-packet-max=1280
+    edns-packet-max=1232
     ```
 
-    After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096).
+    After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). Check out our [unbound guide](../guides/dns/unbound.md) for a comment about the particular value of `1232`.
 
 !!! warning "Ignoring query from non-local network"
 

docs/guides/dns/unbound.md

@@ -112,8 +112,21 @@ server:
     use-caps-for-id: no
 
     # Reduce EDNS reassembly buffer size.
-    # Suggested by the unbound man page to reduce fragmentation reassembly problems
-    edns-buffer-size: 1472
+    # IP fragmentation is unreliable on the Internet today, and can cause
+    # transmission failures when large DNS messages are sent via UDP. Even
+    # when fragmentation does work, it may not be secure; it is theoretically
+    # possible to spoof parts of a fragmented DNS message, without easy
+    # detection at the receiving end. Recently, there was an excellent study
+    # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
+    # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
+    # in collaboration with NLnet Labs explored DNS using real world data from the
+    # the RIPE Atlas probes and the researchers suggested different values for
+    # IPv4 and IPv6 and in different scenarios. They advise that servers should
+    # be configured to limit DNS messages sent over UDP to a size that will not
+    # trigger fragmentation on typical network links. DNS servers can switch
+    # from UDP to TCP when a DNS response is too big to fit in this limited
+    # buffer size. This value has also been suggested in DNS Flag Day 2020.
+    edns-buffer-size: 1232
 
     # Perform prefetching of close to expired message cache entries
     # This only applies to domains that have been frequently queried
@@ -143,6 +156,14 @@ dig pi-hole.net @127.0.0.1 -p 5335
 
 The first query may be quite slow, but subsequent queries, also to other domains under the same TLD, should be fairly quick.
 
+You should also consider adding
+
+``` plain
+edns-packet-max=1232
+```
+
+to a config file like `/etc/dnsmasq.d/99-edns.conf` to signal FTL to adhere to this limit.
+
 ### Test validation
 
 You can test DNSSEC validation using

docs/guides/vpn/wireguard/internal.md

@@ -44,6 +44,17 @@ PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w
     Substitute `eth0` in the preceding lines to match the Internet-facing interface. This may be `ens2p0` or similar on more recent Ubuntu versions (check, e.g., `ip a` for details about your local interfaces).
 <!-- markdownlint-enable code-block-style -->
 
+<!-- markdownlint-disable code-block-style -->
+!!! warning "**Important:** Debian Bullseye (Debian 11) and Raspian 11"
+    Debian Bullseye doesn't include iptables per default and uses nftables.
+
+    We have to set following rules for PostUP and PostDown:
+    ```bash
+    PostUp = nft add table ip wireguard; nft add chain ip wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip wireguard wireguard_chain oifname "eth0" counter packets 0 bytes 0 masquerade; nft add table ip6 wireguard; nft add chain ip6 wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip6 wireguard wireguard_chain oifname "eth0" counter packets 0 bytes 0 masquerade
+    PostDown = nft delete table ip wireguard; nft delete table ip6 wireguard
+    ```
+<!-- markdownlint-enable code-block-style -->
+
 `PostUp` and `PostDown` defines steps to be run after the interface is turned on or off, respectively. In this case, iptables is used to set Linux IP masquerade rules to allow all the clients to share the server’s IPv4 and IPv6 address.
 The rules will then be cleared once the tunnel is down.